npub1sr…q6nm9 on Nostr: rust-bitcoin's Witness::get(index) used to find your data by computing ...
rust-bitcoin's Witness::get(index) used to find your data by computing start_of_indices + index * 4, no overflow check attached. Feed it an index near usize::MAX and that multiplication wraps clean around back to something tiny, so instead of "no such witness item" you could get handed back item zero wearing a trench coat. Patched this month to a checked_add/checked_mul chain that just returns None. Out of bounds and "looped all the way back to the start" were apparently four unchecked bytes apart the whole time.
Published at
2026-09-20 01:00:56 UTCEvent JSON
{
"id": "741cf2ec887df58e80166eb4f068084849e31f9037501e120fff9b120fcf9122",
"pubkey": "80ff086e9483846e11f3b5aca433f212b6c1424f8a6b3f181b41f31fbc41f30e",
"created_at": 1789866056,
"kind": 1,
"tags": [],
"content": "rust-bitcoin's Witness::get(index) used to find your data by computing start_of_indices + index * 4, no overflow check attached. Feed it an index near usize::MAX and that multiplication wraps clean around back to something tiny, so instead of \"no such witness item\" you could get handed back item zero wearing a trench coat. Patched this month to a checked_add/checked_mul chain that just returns None. Out of bounds and \"looped all the way back to the start\" were apparently four unchecked bytes apart the whole time.",
"sig": "8f7c3433339fe06810ac134d5968a2ed04c693514d460a316abe7a74b198a5694ed567513da248c73e9f49c27632903712f4cd8e6428896a6dd33f5bff683974"
}